[EhabY]

Dependencies

• pnpm 12.15.0 and dependencies within their ranges.
• @opentelemetry/api 1.10 exports the logs API, so SeverityNumber comes from it and @opentelemetry/api-logs is removed.
• oxlint 1.90 enables typescript/no-unsafe-enum-assignment. It caught a parsed TLS alert number returned as CLIENT_CERT_ALERT without narrowing, now fixed with a type guard.
• upload-artifact, download-artifact, setup-node, pnpm/setup (v3.1.2 skips saving an unchanged store), and the devcontainer base image.

Caching

Every CI job on main saved its own ~175 MB pnpm store (2.7 GB of cache).

• CI uses cache-mode: read. A new Cache workflow (pushes to main, one job per platform) is the only writer, for the pnpm store and Pixel's Chromium.
• Release workflows use cache-mode: none so published builds come from a clean install. The pull_request_target workflows also use none.

CI

• Superseded PR runs are cancelled, and CI and release jobs set timeouts instead of the 6 hour default.
• Unit tests retry the Electron binary download. Electron 45 fetches it without retrying, which failed an ARM64 run with a 504.
• Windows ARM64 unit tests moved to their own Windows ARM64 workflow (main and workflow_dispatch), so PRs no longer list a skipped check. Installing on windows-11-arm took 3 of 4.5 minutes, and in 200 runs it never caught a failure the other platforms missed.
• Lint no longer runs pnpm build, since the integration tests and Package already build.
• The setup composite action is renamed pnpm-setup.
• Dependabot now scans .github/actions/*. Before, it only covered workflows, so chore(deps): bump the actions group with 3 updates #1056 bumped setup-node in the workflows but not in the composite action.

Releases

release.yaml now handles every v* tag and publishes a pre-release for -pre tags. It replaces pre-release.yaml and publish-extension.yaml.

• Same as before: version validation, the main-only check for stable tags, skipping a marketplace whose token is unset, and draft GitHub releases.
• Tighter:
  • Only the GitHub release job can write.
  • The tag is read from $GITHUB_REF_NAME, not pasted into scripts.
  • The vsce version passed to the publish job must be a plain version.
• Names: pre-releases run under the Release workflow, shown as Pre-Release v<version>-pre.
• Untested: this only runs on a tag push. A throwaway -pre tag from a branch would exercise it.

Notes

The Windows ARM64 pnpm store prune warning now shows only in Cache / Windows ARM64. It comes from pnpm failing to remove a stale symlink in the restored store (os error 267), not from duplicate jobs.

🤖 Generated with Claude Code